RANSOM_FAKEGLOBE.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %User Temp%\qfjgmfgmkj.tmp

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %User Temp%\hjkhkHUhhjp.bat -> this will delete initially executed copy of malware and itself

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Process Termination

This Ransomware terminates the following processes if found running in the affected system's memory:

• sql
• outlook
• postgre
• smss

Other Details

This Ransomware deletes the initially executed copy of itself

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• {Malware Name}
• {GUID}
• .sys
• .midi
• .cda
• .cpl
• .drv
• .z
• .fnt
• .fon
• .off
• .gadget
• .wsf
• .xhtml
• .vb

It avoids encrypting files found in the following folders:

• windows
• Desktop
• Microsoft
• Microsoft Help
• Windows App Certification Kit
• Windows Defender
• ESET
• COMODO
• Windows NT
• Windows Kits
• Windows Mail
• Windows Media Player
• Windows Multimedia Platform
• Windows Phone Kits
• Windows Phone Silverlight Kits
• Windows Photo Viewer
• Windows Portable Devices
• Windows Sidebar
• WindowsPowerShell
• Temp
• NVIDIA Corporation
• Microsoft.NET
• Internet Explorer
• Kaspersky Lab
• McAfee
• Avira
• spytech software
• sysconfig
• Avast
• Dr.Web
• Symantec
• Symantec_Client_Security
• system volume information
• AVG

It appends the following extension to the file name of the encrypted files:

• .pizdec

It drops the following file(s) as ransom note:

• {Encrypted file directory}\how_to_open_files.html

NOTES:

The ransom note contains the following: